OFAC Screening Data Retention

Keeping screening logs and compliance records for the period required by regulation, typically five years or more, so decisions can be audited.

TL;DR

TL;DR: Data retention means storing the evidence of each screening decision for the required period, typically five years or more. It is what lets you answer an OFAC inquiry with facts instead of memory.

What retention requires

Retention is more than keeping files; it means the records must be complete and retrievable. For screening, the useful record includes the counterparty identifier, the list data checked, the match result, the decision taken, and the timestamp. A five-year window means the operator must be able to reconstruct a specific check long after the payment settled.

Why it matters for agent payments

An agent that runs screening on every payment generates the raw material for retention automatically, but only if the results are stored. Wiring the check to log each call with its outcome gives a durable audit trail without extra effort. If a payment is later questioned, the operator can show exactly what was screened and what the result was, instead of having no record at all.

Retention essentials

• Store the counterparty and match result for every check
• Keep timestamps and decisions
• Retain records for five years or more

Retention and privacy together

Retention must coexist with data minimization. A screening log stores counterparty identifiers, so it is personal data in many regimes, and the operator must balance the five-year retention requirement against privacy obligations. The practical approach is to log only what compliance requires, secure it, and set the retention window to the regulatory floor. The log is evidence, so its integrity matters as much as its existence.